What is the CVSS score of EUVD-2026-56602?

EUVD-2026-56602 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of SharePoint Server are affected by EUVD-2026-56602?

Microsoft SharePoint Server (2019 and Subscription Edition) contains a privilege escalation vulnerability allowing authenticated users to gain unauthorized elevated access to sensitive business data…. A patch is available.

How to fix or mitigate EUVD-2026-56602?

Within 24 hours: Identify all deployed SharePoint Server 2019 and Subscription Edition instances and document their current build versions against the vendor advisory to determine which systems are affected. Within 7 days: obtain and deploy the vendor-released patch to your test environment, conduct functional validation including custom workflows and integrations, and schedule production deployment. Within 30 days: complete patching of all affected SharePoint instances in production and verify remediation through vendor-supplied validation steps.

SharePoint Server EUVD-2026-56602

| CVE-2026-70355 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-11 secure@microsoft.com

GHSA-wcw7-qcg8-fr2j

XSS Microsoft Sharepoint Server

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Attacker requires a valid account (PR:L), victim interaction is mandatory (UI:R), and scope change applies because script executes in victim's browser session with elevated context; no availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 13, 2026 - 13:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 13, 2026 - 13:52 vuln.today

cvss_changed

CVSS changed

Aug 13, 2026 - 13:52 NVD

7.3 (HIGH) 8.7 (HIGH)

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:46 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.3

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) covers classic cross-site scripting, where attacker-controlled input is rendered as executable script in a victim's browser without adequate sanitization or encoding. SharePoint Server, a Microsoft enterprise collaboration and document management platform, allows users to contribute content to pages and sites; a flaw in input handling enables injection of malicious JavaScript into shared content. The CVSS vector S:C (scope change) confirms that the vulnerability breaks the browser's same-origin trust boundary - script executing in SharePoint's origin can access session tokens, cookies, and perform actions on behalf of the victim with that victim's privileges, enabling privilege escalation. Affected CPEs are cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* (Subscription Edition) and cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* (SharePoint Server 2019).

RemediationAI

The primary fix is to apply the vendor-released cumulative update that addresses this vulnerability. For SharePoint Server 2019, upgrade to build 16.0.10417.20198 or later. For SharePoint Server Subscription Edition, upgrade to build 16.0.19725.20522 or later. Patch details and download links are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70355. If immediate patching is not feasible, compensating controls include restricting write access to SharePoint pages and web parts to trusted, vetted accounts only - removing contributor permissions from broad user groups reduces the attacker's ability to inject content. Enabling SharePoint's built-in HTML field security settings and reviewing custom web part permissions can further reduce injection surface, though these controls are not a full substitute for patching. Internet-facing SharePoint instances should be prioritized for emergency patching given the network attack vector.